Zero-Click AI Vulnerability in Microsoft 365 Copilot: Data Exposure Without User Interaction

TL;DR

A newly discovered zero-click AI vulnerability named EchoLeak allows attackers to extract sensitive data from Microsoft 365 Copilot without any user interaction. This critical vulnerability, identified as CVE-2025-32711, has a CVSS score of 9.3 and poses a significant risk to Microsoft 365 users. The issue has been mitigated, but users should remain vigilant and stay updated with the latest security patches.

Zero-Click AI Vulnerability in Microsoft 365 Copilot

A new cybersecurity threat has emerged, targeting Microsoft 365 Copilot users. Dubbed EchoLeak, this zero-click AI vulnerability enables malicious actors to exfiltrate sensitive data without any user interaction. The vulnerability, designated as CVE-2025-32711, has been rated critical with a CVSS score of 9.3.

Understanding EchoLeak

EchoLeak exploits a flaw in Microsoft 365 Copilot’s AI framework, allowing attackers to access and extract sensitive information from the application’s context. What makes this vulnerability particularly concerning is its zero-click nature, meaning no user interaction is required for the attack to be successful.

Impact and Mitigation

The impact of EchoLeak is significant, as it compromises the security of sensitive data within Microsoft 365 Copilot. However, the good news is that Microsoft has already addressed the issue, and no customer action is required. Users are advised to ensure their systems are up to date with the latest security patches to protect against such vulnerabilities.

For a detailed analysis and updates on the EchoLeak vulnerability, visit the full article: Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data¹

Conclusion

The discovery of the EchoLeak vulnerability underscores the importance of continuous vigilance in cybersecurity. Although Microsoft has mitigated the issue, users must stay informed and proactive in applying security updates. This incident highlights the evolving nature of cyber threats and the need for robust security measures to protect sensitive data.

1. (2025-06-12). “Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data”. The Hacker News. Retrieved 2025-06-12. ↩︎